From 4f43ded5da41303d71258ffbf7b244e7f81b16f9 Mon Sep 17 00:00:00 2001
From: quanticsoul4772 <71096528+quanticsoul4772@users.noreply.github.com>
Date: Wed, 4 Nov 2026 07:05:17 -0800
Subject: [PATCH 1/3] test(nominatim): check cache file modes only where POSIX
 modes exist

The disk-cache test asserts the cache directory is 0o700 and its files
0o600. Windows has no POSIX mode bits (the directory stats as 0o666), so
the test always failed there. Both checks now run only off Windows, as
localServices.test.mjs and mcpPanelKey.test.mjs already do for their
0o600 checks. The cache code is unchanged.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/tooling/nominatimOutlineRoute.test.mjs | 30 ++++++++++++----------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/src/tooling/nominatimOutlineRoute.test.mjs b/src/tooling/nominatimOutlineRoute.test.mjs
index c29b41f21..774099efe 100644
--- a/src/tooling/nominatimOutlineRoute.test.mjs
+++ b/src/tooling/nominatimOutlineRoute.test.mjs
@@ -684,25 +684,29 @@ test('the disk cache survives a restart and stays within its bounds', async () =
     await createNominatimCache({ dir, now: time.now }).get('k0'),
     null,
   );
-  assert.equal(
-    fs.statSync(dir).mode & 0o777,
-    0o700,
-    'the query cache directory is private',
-  );
+  // Windows has no POSIX mode bits (directories stat as 0o666), so only
+  // POSIX systems can check privacy this way.
+  if (process.platform !== 'win32')
+    assert.equal(
+      fs.statSync(dir).mode & 0o777,
+      0o700,
+      'the query cache directory is private',
+    );
   const text = fs
     .readdirSync(dir)
     .filter((name) => name.endsWith('.json'))
     .map((name) => fs.readFileSync(path.join(dir, name), 'utf8'))
     .join('\n');
   assert.equal(text.includes('k4'), false, 'disk entries never store raw keys');
-  for (const name of fs
-    .readdirSync(dir)
-    .filter((entry) => entry.endsWith('.json')))
-    assert.equal(
-      fs.statSync(path.join(dir, name)).mode & 0o777,
-      0o600,
-      `${name} is private`,
-    );
+  if (process.platform !== 'win32')
+    for (const name of fs
+      .readdirSync(dir)
+      .filter((entry) => entry.endsWith('.json')))
+      assert.equal(
+        fs.statSync(path.join(dir, name)).mode & 0o777,
+        0o600,
+        `${name} is private`,
+      );
   fs.rmSync(dir, { recursive: true, force: true });
 });
 

From 1c2cdc67752df80491ff6aa97708074b18d3029c Mon Sep 17 00:00:00 2001
From: quanticsoul4772 <71096528+quanticsoul4772@users.noreply.github.com>
Date: Wed, 4 Nov 2026 07:06:45 -0800
Subject: [PATCH 2/3] changelog: Nominatim cache mode test on Windows (#1547)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 changelog.d/1547-nominatim-cache-mode-windows.md | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 changelog.d/1547-nominatim-cache-mode-windows.md

diff --git a/changelog.d/1547-nominatim-cache-mode-windows.md b/changelog.d/1547-nominatim-cache-mode-windows.md
new file mode 100644
index 000000000..9a48b1ee6
--- /dev/null
+++ b/changelog.d/1547-nominatim-cache-mode-windows.md
@@ -0,0 +1,3 @@
+- The Nominatim disk-cache test checks the cache directory and file modes
+  only where POSIX modes exist, so it no longer always fails on Windows
+  (quanticsoul4772, #1547).

From e5ab5f945a3ea5ae28c21a200a63fd2277f4d0dd Mon Sep 17 00:00:00 2001
From: quanticsoul4772 <71096528+quanticsoul4772@users.noreply.github.com>
Date: Thu, 5 Nov 2026 05:43:36 -0800
Subject: [PATCH 3/3] test(nominatim): share one POSIX guard and say the cache
 is private only on POSIX

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/tooling/nominatimOutlineRoute.test.mjs | 19 ++++++++++++-------
 1 file changed, 12 insertions(+), 7 deletions(-)

diff --git a/src/tooling/nominatimOutlineRoute.test.mjs b/src/tooling/nominatimOutlineRoute.test.mjs
index 774099efe..74f0b2d6a 100644
--- a/src/tooling/nominatimOutlineRoute.test.mjs
+++ b/src/tooling/nominatimOutlineRoute.test.mjs
@@ -684,29 +684,34 @@ test('the disk cache survives a restart and stays within its bounds', async () =
     await createNominatimCache({ dir, now: time.now }).get('k0'),
     null,
   );
-  // Windows has no POSIX mode bits (directories stat as 0o666), so only
-  // POSIX systems can check privacy this way.
-  if (process.platform !== 'win32')
+  // The cache is private only through POSIX mode bits. Windows has none
+  // (directories stat as 0o666) and the cache keeps the checkout's ACLs,
+  // so these checks run, and privacy holds, only on POSIX systems.
+  const posixModes = process.platform !== 'win32';
+  if (posixModes) {
     assert.equal(
       fs.statSync(dir).mode & 0o777,
       0o700,
-      'the query cache directory is private',
+      'the query cache directory is private (POSIX modes)',
     );
+  }
   const text = fs
     .readdirSync(dir)
     .filter((name) => name.endsWith('.json'))
     .map((name) => fs.readFileSync(path.join(dir, name), 'utf8'))
     .join('\n');
   assert.equal(text.includes('k4'), false, 'disk entries never store raw keys');
-  if (process.platform !== 'win32')
+  if (posixModes) {
     for (const name of fs
       .readdirSync(dir)
-      .filter((entry) => entry.endsWith('.json')))
+      .filter((entry) => entry.endsWith('.json'))) {
       assert.equal(
         fs.statSync(path.join(dir, name)).mode & 0o777,
         0o600,
-        `${name} is private`,
+        `${name} is private (POSIX modes)`,
       );
+    }
+  }
   fs.rmSync(dir, { recursive: true, force: true });
 });